Merge dev to main: Security improvements and comprehensive test infrastructure #39

Merged
jimmy merged 195 commits from dev into main 2026-04-08 01:42:27 +08:00
3 changed files with 25 additions and 55 deletions
Showing only changes of commit 55d3348085 - Show all commits
+7 -16
View File
@@ -18,18 +18,9 @@ concurrency:
jobs: jobs:
deploy-claude-dev-dev: deploy-claude-dev-dev:
runs-on: ubuntu-latest runs-on: ubuntu-latest
container:
volumes:
- /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
- /volume1/docker/claude-dev:/claude-dev-runtime
steps: steps:
- name: Checkout exact commit - name: Checkout repository
run: | uses: actions/checkout@v4
set -euo pipefail
git init .
git remote add origin http://gitea:3000/jimmy/nas-tools.git
git fetch --depth 1 origin "$GITHUB_SHA"
git checkout --detach FETCH_HEAD
- name: Resolve image tags - name: Resolve image tags
run: | run: |
@@ -89,10 +80,10 @@ jobs:
- name: Record previous image - name: Record previous image
run: | run: |
set -euo pipefail set -euo pipefail
mkdir -p /claude-dev-runtime mkdir -p /volume1/docker/claude-dev
previous_image="$(docker inspect -f '{{.Config.Image}}' claude-dev 2>/dev/null || true)" previous_image="$(docker inspect -f '{{.Config.Image}}' claude-dev 2>/dev/null || true)"
if [ -n "$previous_image" ]; then if [ -n "$previous_image" ]; then
printf '%s\n' "$previous_image" > /claude-dev-runtime/previous-image.txt printf '%s\n' "$previous_image" > /volume1/docker/claude-dev/previous-image.txt
echo "Saved previous image: $previous_image" echo "Saved previous image: $previous_image"
else else
echo "No existing claude-dev container found" echo "No existing claude-dev container found"
@@ -101,8 +92,8 @@ jobs:
- name: Sync compose and target tag - name: Sync compose and target tag
run: | run: |
set -euo pipefail set -euo pipefail
cp claude-dev/docker-compose.yml /claude-dev-runtime/docker-compose.yml cp claude-dev/docker-compose.yml /volume1/docker/claude-dev/docker-compose.yml
printf '%s\n' "$CLAUDE_DEV_IMAGE_TAG" > /claude-dev-runtime/target-tag.txt printf '%s\n' "$CLAUDE_DEV_IMAGE_TAG" > /volume1/docker/claude-dev/target-tag.txt
- name: Remove stale claude-dev container - name: Remove stale claude-dev container
run: docker rm -f claude-dev || true run: docker rm -f claude-dev || true
@@ -110,7 +101,7 @@ jobs:
- name: Deploy claude-dev - name: Deploy claude-dev
run: | run: |
set -euo pipefail set -euo pipefail
CLAUDE_DEV_IMAGE_TAG="$CLAUDE_DEV_IMAGE_TAG" docker compose -f /claude-dev-runtime/docker-compose.yml up -d --pull never CLAUDE_DEV_IMAGE_TAG="$CLAUDE_DEV_IMAGE_TAG" docker compose -f /volume1/docker/claude-dev/docker-compose.yml up -d --pull never
- name: Post-deploy runtime checks - name: Post-deploy runtime checks
run: | run: |
+7 -25
View File
@@ -13,19 +13,9 @@ concurrency:
jobs: jobs:
deploy-dev: deploy-dev:
runs-on: ubuntu-latest runs-on: ubuntu-latest
container:
options: --pid=host
volumes:
- /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
- /volume1/docker/nas-dashboard:/nas-dashboard
steps: steps:
- name: Checkout exact commit - name: Checkout repository
run: | uses: actions/checkout@v4
set -euo pipefail
git init .
git remote add origin http://gitea:3000/jimmy/nas-tools.git
git fetch --depth 1 origin "$GITHUB_SHA"
git checkout --detach FETCH_HEAD
- name: Warm mirror cache for base images - name: Warm mirror cache for base images
run: | run: |
set -u set -u
@@ -61,19 +51,11 @@ jobs:
export DOCKER_API_VERSION=1.43 export DOCKER_API_VERSION=1.43
DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest -t nas-dashboard-dev:latest dashboard/ DOCKER_BUILDKIT=0 docker build --cache-from nas-dashboard-dev:latest -t nas-dashboard-dev:latest dashboard/
- name: Sync runtime compose file - name: Sync runtime compose file
run: cp dashboard/docker-compose.dev.yml /nas-dashboard/docker-compose.dev.yml run: cp dashboard/docker-compose.dev.yml /volume1/docker/nas-dashboard/docker-compose.dev.yml
- name: Deploy dev - name: Deploy dev
run: | run: |
set -euo pipefail
export DOCKER_API_VERSION=1.43 export DOCKER_API_VERSION=1.43
# Write deploy script to mounted volume (accessible from both container and host) cd /volume1/docker/nas-dashboard
cat > /nas-dashboard/deploy.sh << 'EOF' docker rm -f nas-dashboard-dev || true
#!/bin/bash docker compose -f docker-compose.dev.yml up -d --pull never
set -euo pipefail
export DOCKER_API_VERSION=1.43
cd /volume1/docker/nas-dashboard
/volume1/@appstore/ContainerManager/usr/bin/docker rm -f nas-dashboard-dev || true
/volume1/@appstore/ContainerManager/usr/bin/docker compose -f docker-compose.dev.yml up -d --pull never
EOF
chmod +x /nas-dashboard/deploy.sh
# Execute script on host using the host path
nsenter -t 1 -m -n /volume1/docker/nas-dashboard/deploy.sh
+11 -14
View File
@@ -15,18 +15,17 @@ jobs:
steps: steps:
- name: Checkout repository - name: Checkout repository
run: | uses: actions/checkout@v4
git clone http://gitea:3000/jimmy/nas-tools.git .
git checkout ${{ github.sha }}
- name: Install Python - name: Set up Python
run: | uses: actions/setup-python@v5
apt-get update && apt-get install -y python3 python3-pip python3-venv with:
python-version: '3.12'
- name: Install dependencies - name: Install dependencies
run: | run: |
cd dashboard/backend cd dashboard/backend
python3 -m venv venv python -m venv venv
. venv/bin/activate . venv/bin/activate
pip install -r requirements.txt pip install -r requirements.txt
pip install -r requirements-dev.txt pip install -r requirements-dev.txt
@@ -52,14 +51,12 @@ jobs:
steps: steps:
- name: Checkout repository - name: Checkout repository
run: | uses: actions/checkout@v4
git clone http://gitea:3000/jimmy/nas-tools.git .
git checkout ${{ github.sha }}
- name: Install Node.js - name: Set up Node.js
run: | uses: actions/setup-node@v4
curl -fsSL https://deb.nodesource.com/setup_20.x | bash - with:
apt-get install -y nodejs node-version: '20'
- name: Install dependencies - name: Install dependencies
run: | run: |